Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

JRHelgeson writes "In a story strangely reminiscent of Superman 3, a 'hacker' allegedly stole over $50,000 from PayPal, Google Checkout as well as several unnamed online brokerage firms. When opening an online brokering account it is common practice for companies such as E-trade and Schwab to send a tiny payment — ranging from only a few cents to a couple of dollars — to verify that the user has access to the bank account listed. According to the story, the attacker wrote a script that opened thousands of accounts at dozens of these providers. He was arrested not for taking the money, but for using false names in order to get it."

"
And I, I walked over to the, to the bench there, and there is, Group W's
where they put you if you may not be moral enough to join the army after
committing your special crime, and there was all kinds of mean nasty ugly
looking people on the bench there. Mother rapers. Father stabbers. Father
rapers! Father rapers sitting right there on the bench next to me! And
they was mean and nasty and ugly and horrible crime-type guys sitting on the
bench next to me. And the meanest, ugliest, nastiest one, the meanest
father raper of them all, was coming over to me and he was mean 'n' ugly
'n' nasty 'n' horrible and all kind of things and he sat down next to me
and said, "Kid, whad'ya get?" I said, "I didn't get nothing, I had to pay
$50 and pick up the garbage." He said, "What were you arrested for, kid?"
And I said, "Littering." And they all moved away from me on the bench
there, and the hairy eyeball and all kinds of mean nasty things, till I
said, "And creating a nuisance." And they all came back, shook my hand,
and we had a great time on the bench, talkin about crime, mother stabbing,
father raping, all kinds of groovy things that we was talking about on the
bench.
"

With every ATM deposit, one can key in a slight over-amount, when specifying the deposit. If you are depositing checks for $123.45, you could key in maybe $123.54 (transposing the last two digits).

Most always, the bank sees the foolishness in sending a letter (costing at least 42 cents) to correct a small error. So they apparently just write off the difference, and leave the ATM deposit as reported.

Contrary to your apocryphal belief, banks have entire departments that spend more than the collection is worth to make you balance your account if it is out of balance. This discourages bigger crimes, which would cost them more just on a statistical basis.

You may get away with the "few pennies" mistake once per institution. Three or four times? They'll freeze your funds and demand you clean up your act.

Because here's a secret you should have known: When you give the bank the money, it's not yours any more. It's theirs. You lent it to them, and they owe it to you, but you can't just take it. You are nothing more than a lender, and they are a borrower. You have all the rights of a creditor. Which, you might guess, means you can spend thousands of dollars on legal hassles trying to free up the $123.45 you deposited to steal that 9 cents.

How could he be "Stealing from Banks" when Paypal is not a bank [slashdot.org]. Google Checkout is not a bank either.

Neither are required to safeguard your money the same way a bank does. Paypal can and often does freeze the deposits in accounts for it's members without warning and your recourse towards unfreezing accounts leaves much to be said. I haven't heard horror stories about Google Checkout but they are not a bank either - they are a payment processor for merchants.

Peter: "That virus you're always talking about, right? The one that could, uh, rip off the company for a bunch of money."
Michael: "Yeah, what about it?"
Peter: "Well, how does it work?"
Michael: "It's pretty brilliant. What it does is, every time there's a bank transaction where interest is competed, you know, thousands a day, the computer ends up with these fractions of acent, which it usually rounds off. What this does is, it takes those little remainders and puts it into an account."
Peter: "This sounds familiar."Michael: "Yeah, they did it in Superman III."Peter: "Right."Michael: "Yeah. Underrated movie, actually. And then there were a bunch of hackers, did it in the '70s as well. One of them got busted."Peter: "Well, so they check for this now."Michael: "No, here's the thing. Initech's so backed up with all the software we're updating for the year 2000, they'd never notice."Peter: "You're right. And even if they wanted to, they couldn't check all that code."Michael: "Thumbs up their asses. Thumbs up their asses."

How is this like Superman 3? I thought the point in that movie was to shave off the remainders in interest calculations. This is just a simple case of seeing someone transfer a few cents to your account when you open it and trying to abuse the system. The problem of course is that it's extremely obvious and you'll get caught, just like this guy did.

I believe that the reference to Superman 3 is actually a meta-reference to Office Space. (Or maybe the reference being referenced is the meta-reference -- I'm not a philosopher.) As Office Space itself noted, the method long precedes either movie.

The point isn't that Superman 3 invented it, the point is that most people first heard of it from watching Superman 3 and so when you're trying to explain to people what you're doing, you can say "you know, like Superman 3" and they know what you mean. Thus the joke in Office Space:

A: B: "Huh?"A: "You know, like in Superman 3."B: "Oooh, now I get it."

It's funny, damnit. Made funnier than Superman 3 is actually a pretty awful movie. (But it's an awful movie that most everybody's seen.)

It's been happening in meatspace for thousands of years (though not so much anymore). People would shave bits off of coins made of precious metals and then smelt and sell the shavings to wind up with more money than they started with. Wikipedia notes that some British silver coins would routinely be milled down to half their original weight as nearly everyone took a little bit off the edge.

Eventually, coins could be made with milled edges, which largely curbed the practice, and today, of course, most coins are made from metals that are worth very little compared to the value of the coin itself.

Actually, IIRC, pennies and nickels are currently worth more as metal than as coins. A penny is something like 1.2 cents and a nickel is about 6 cents, at least that was the case in Sept. 2006, which is the most recent mint report I can get at the us mint site.

There is a difference between how much it costs something to manufacture and how much its metals are worth. Right now the metal value of lincoln cents is around.561 cents. less than the value of a penny. You can use base metal coin calculator [coinflation.com] which tends to have current prices.

in the US, NOBODY cant take the money out of your bank account without your authorization

(Assuming you aren't being sly with the double-negative...)

Then you have some learnin' to do about how ACH transactions work. Authorization for withdrawals is required, but it is certainly not passed along with the transaction itself. The system relies heavily on trust. If someone challenges a transaction, and their bank demands proof of authorization, then yes, you'd better have it. But if the transaction is not challenged or rejected, then it stands.

As far as I can tell, the article doesn't actually mention that Largent managed to rip off PayPal, only that PayPal, Google Checkout, et al. use the small deposit method for verification. Seriously, reading for comprehension isn't hard, people. Hell, it even mentions the scope right in the lede.

He was arrested not for taking the money, but for using false names in order to get it.

Of course he wasn't arrested for taking the money. Said institutions willingly deposited that money into his account(s), yes? And these institutions did so under the pretense that this was to identify the customer? So the charge makes sense. The guy didn't steal money, it was given to him... a "him" with a fake identity.

If you have to make up a name or SSN to open the account, then in fact, you are doing something wrong. Color me simple, but that's the way I see it.:\
This is clearly a case where a novel approach to crime is still, well, criminal.

Largent used an automated script to open 58,000 such accounts, collecting many thousands of these small payments into a few personal bank accounts.

As much as the bank looks oddly at a sudden amount of large withdrawls, they'd certainly take the time to wonder why someone is getting three cents continuously deposited into their account. How did he figure he would not get caught?

When his bank contacted him about the thousands of small payments, Largent explained that he had read the terms of service of the sites he was targeting, and believed he was doing nothing wrong, claiming that he needed the money to pay off debts.

As much as the bank looks oddly at a sudden amount of large withdrawls, they'd certainly take the time to wonder why someone is getting three cents continuously deposited into their account.

It doesn't strike me as at all inevitable that his bank would notice. Alarms on the automated systems which trigger human intervention would I expect be primarily based on large transactions, not small ones. I suppose there must be a specific trigger for an unusually large number of transactions, or a trigger for a re

No, they're not. That's why PayPal can get away with the shit they do. It's a common misconception that most people fall into, that because PayPal handles money, they must be a bank and subject to the same set of regulations you trust to put the stops on your bank if they get fresh with your money (including insurance. PayPal is not FDIC insured if you use their "high yield" holding option).

The problem here is that the transactions involved banks. The fact that PayPal was the conduit is irrelevant in this

The amounts were being deposited into the same few bank accounts. The thing I can't figure out is, given the sheer number of transactions involved, how was this not spotted sooner?

If there was an assumption that it wasn't worth it prior to this (due to the tiny amounts involved in a genuine authentication check), I assume now they will implement a system that flags a bank account which receives authenticating deposits over a certain number.

I'll assume the guy was using the same IP address to create the accounts. I wonder why the hosts don't have some kind of software to look for IP's that open multiple accounts?

Probably wouldn't work very well seeing as most ISPs allocate IP addresses through DHCP - and even if they didn't your idea breaks as soon as someone releases a block of numbers for whatever reason and it gets taken and re-used by someone else.

You can set a time limit on the threshold. Assume 32 days in a month $50 000 would be $1562 per day that's $65 worth of micro payments in an hour. That's a lot of transactions to be spread around not very many providers.

They could flag anything over a certain amount per hour or per day and catch the worst of the offenders.

I'm guessing the only reason they haven't done that so far is because it didn't occur to anyone that the system could be gamed that way.

At least he did not create a script that automatically rounded every payment up to the nearest... oh wait...

Even if he gets a fine, he can always apply to pay off the debt in small payments - say a few cents every time...

Reminds me of a debt my father picked up from a school my sister attended for less then a week. They charged him for a whole year. Not to be deterred he promptly paid them half the amount they invoiced him for. Months later and six angry letters later he paid them half of the sum they asked for. Months later.. ah well, I am sure you can see the pattern here. Fast forward 14 years and they finally wrote of the rest of his debt (I think 1GPB) as a good will gesture (and I am reliably informed he is legend in the schools finance department). I have no idea how much the administration cost to school at the end of it, but it all seemed good natured enough.

I wouldn't call him "ingenious", due to the fact that he overlooked quite a few details. (Namely, using only a handful of bank accounts, and believing no one would notice the activity on the accounts.)

He's more in trouble for misrepresenting himself and using assumed identities. It might fall under "uttering a forged instrument", but I'm not sure.

I remember the interest rounding hack of the 80s. Bank IT personell at a few occasions got the smart idea to transfer rounding remainders from interest calculations onto an internal bank account. The extra small micro sums (fractions of currency units) from all interest calculations would quickly add up to many millions, virtually producing money from nothing. A few got caught, but I wonder how many IT guys at banks actually got away with that.AFAICT the same thing should still be possible today when intere

I don't understand how he managed to do this. He can't use 50,000 bank accounts. There aren't 50,000 payment services. So why would any of them send a few cents to the same bank account more than once?

Look at this from Paypal's perspective: you've got millions of people trying to sign up on your system. Statistically speaking, hundreds of thousands of them are not so bright, and will do things like forget they already tried signing up, not see their bank statement and try doing it again, etc. Since the cost of re-authenticating them is less than a buck (mostly for the ACH transfer fees) and the expected lifetime value of the account is still (for Paypal = eBay) anywhere from $10 to several hundred to depending on where you got the lead, obviously you want to let them try it again.

So we've disposed with the rationale for prohibiting 2 verifications. Now we need to draw a line somewhere. Here's what goes through this engineer's brain: it isn't obvious to me that putting the line at 3 is any better than putting it at 2. The possibility of exploit is remote, the damage from exploit is minimal and containable, engineer time is expensive, there might be some legal/regulatory/compliance issues that prohibit me from solving this problem in a minute by arbitrarily setting MAX_VERIFICATION_TRANSFERS to 20, and any restriction multiplied by millions of customers causes support problems and the attendant costs.

So yeah, I think that not doing the seemingly obvious thing is defensible here. The goal of Paypal/the bnaks/etc isn't to be fraud free, it is to maximize profits. Sometimes, the profit maximizing path means tolerating security risks with minor impact and non-trivial costs to address. Did it work for Paypal in this instance? Well, yeah -- they had about a decade of no problems and then when a problem finally did crop up it cost them less than a man-month to resolve. Easy peasy.

You absolutely have to tip your hat at this guy. I'm not sure if I feel bad for the financial institutions "bilked" by him (I'm sure they'll recover the money from insurance) or their CEOs that make millions while the stocks underperform, but I feel bad for him. After all he's just playing the system they set up to begin with.

It's obvious he knew exactly what he was doing, and he knew it was wrong. But you have to acknowledge the inventiveness and sheer perseverance.

Instead of transferring it into your own account transfer it into the account of someone you hate. Getting someone's account number is actually not all that difficult. It's on every check they write for instance. Mmmm. The sweet taste of revenge.

Steal a penny from the Banks - go to jail - Banks steals $10 from you - calls it a "service charge".

We need the banks (except the World Bank), but it is despicable that they are allowed to play with our money the way they do. Twice I have been locked out of my money. And it was a weekend, so the banks were closed. I asked the 24/7 help guy from India what I should do, and his advice was: Can you borrow some money from someone until Monday when the bank opens?